CVE-2022-21654
7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| envoyproxy | envoy | >= 1.7.0, < 1.18.6 | affected |
| envoyproxy | envoy | >= 1.19.0, < 1.19.3 | affected |
| envoyproxy | envoy | >= 1.20.0, < 1.20.2 | affected |
| envoyproxy | envoy | >= 1.21.0, < 1.21.1 | affected |
Weaknesses
- CWE-295: CWE-295: Improper Certificate Validation
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
- https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
- https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.